CVE-2021-35560
Vulnerability in the Java SE product of Oracle Java SE (component: Deployment). The supported...
Vulnerability in the Java SE product of Oracle Java SE (component: Deployment). The supported version that is affected is Java SE: 8u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
7.5
Vulnerability in the Java SE product of Oracle Java SE (component: Deployment). The supported version that is affected is Java SE: 8u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
- Record
CVE-2021-35560- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
EUVDEUVD-2021-22196
7.5
Vulnerability in the Java SE product of Oracle Java SE (component: Deployment). The supported version that is affected is Java SE: 8u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
- Record
EUVD-2021-22196- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q6fp-hjwx-q999
7.5
Vulnerability in the Java SE product of Oracle Java SE (component: Deployment). The supported...
Vulnerability in the Java SE product of Oracle Java SE (component: Deployment). The supported version that is affected is Java SE: 8u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
- Record
GHSA-q6fp-hjwx-q999- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
NVD
7.5
Vulnerability in the Java SE product of Oracle Java SE (component: Deployment). The supported version that is affected is Java SE: 8u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
- Record
CVE-2021-35560- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
OSVRHSA-2021:5030
7.5
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2021:5030- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2022:0345
7.5
Red Hat Security Advisory: java-1.8.0-ibm security update
- Record
RHSA-2022:0345- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVBIT-java-2021-35560 No score
Vulnerability in the Java SE product of Oracle Java SE (component: Deployment). The supported version that is affected is Java SE: 8u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
- Record
BIT-java-2021-35560- Updated
- 2026-11-02
OSVBIT-java-min-2021-35560 No score
Vulnerability in the Java SE product of Oracle Java SE (component: Deployment). The supported version that is affected is Java SE: 8u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
- Record
BIT-java-min-2021-35560- Updated
- 2026-11-02
OSVBIT-jre-2021-35560 No score
Vulnerability in the Java SE product of Oracle Java SE (component: Deployment). The supported version that is affected is Java SE: 8u301. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
- Record
BIT-jre-2021-35560- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:0108-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
- Update to Java 8.0 Service Refresh 7 Fix Pack 0
- CVE-2021-41035: before version 0.29.0, the openj9 JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods. (bsc#1194198, bsc#1192052)
- CVE-2021-35586: Excessive memory allocation in BMPImageReader. (bsc#1191914)
- CVE-2021-35564: Certificates with end dates too far in the future can corrupt keystore. (bsc#1191913)
- CVE-2021-35559: Excessive memory allocation in RTFReader. (bsc#1191911)
- CVE-2021-35556: Excessive memory allocation in RTFParser. (bsc#1191910)
- CVE-2021-35565: Loop in HttpsServer triggered during TLS session close. (bsc#1191909)
- CVE-2021-35588: Incomplete validation of inner class references in ClassFileParser. (bsc#1191905)
- CVE-2021-2341: Fixed a flaw inside the FtpClient. (bsc#1188564)
- CVE-2021-2369: JAR file handling problem containing multiple MANIFEST.MF files. (bsc#1188565)
- CVE-2021-2163: Incomplete enforcement of JAR signing disabled algorithms. (bsc#1185055)
- CVE-2021-35560: Fixed a vulnerability in the component Deployment. (bsc#1191902)
- CVE-2021-35578: Fixed unexpected exception raised during TLS handshake. (bsc#1191904)
- Record
openSUSE-SU-2022:0108-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:0107-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
- Update to Java 8.0 Service Refresh 7 Fix Pack 0
- CVE-2021-41035: before version 0.29.0, the openj9 JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods. (bsc#1194198, bsc#1192052)
- CVE-2021-35586: Excessive memory allocation in BMPImageReader. (bsc#1191914)
- CVE-2021-35564: Certificates with end dates too far in the future can corrupt keystore. (bsc#1191913)
- CVE-2021-35559: Excessive memory allocation in RTFReader. (bsc#1191911)
- CVE-2021-35556: Excessive memory allocation in RTFParser. (bsc#1191910)
- CVE-2021-35565: Loop in HttpsServer triggered during TLS session close. (bsc#1191909)
- CVE-2021-35588: Incomplete validation of inner class references in ClassFileParser. (bsc#1191905)
- CVE-2021-2341: Fixed a flaw inside the FtpClient. (bsc#1188564)
- CVE-2021-2369: JAR file handling problem containing multiple MANIFEST.MF files. (bsc#1188565)
- CVE-2021-2163: Incomplete enforcement of JAR signing disabled algorithms. (bsc#1185055)
- CVE-2021-35560: Fixed a vulnerability in the component Deployment. (bsc#1191902)
- CVE-2021-35578: Fixed unexpected exception raised during TLS handshake. (bsc#1191904)
- Record
SUSE-SU-2022:0107-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:0108-1 No score
Security update for java-1_8_0-ibm
This update for java-1_8_0-ibm fixes the following issues:
- Update to Java 8.0 Service Refresh 7 Fix Pack 0
- CVE-2021-41035: before version 0.29.0, the openj9 JVM does not throw IllegalAccessError for MethodHandles that invoke inaccessible interface methods. (bsc#1194198, bsc#1192052)
- CVE-2021-35586: Excessive memory allocation in BMPImageReader. (bsc#1191914)
- CVE-2021-35564: Certificates with end dates too far in the future can corrupt keystore. (bsc#1191913)
- CVE-2021-35559: Excessive memory allocation in RTFReader. (bsc#1191911)
- CVE-2021-35556: Excessive memory allocation in RTFParser. (bsc#1191910)
- CVE-2021-35565: Loop in HttpsServer triggered during TLS session close. (bsc#1191909)
- CVE-2021-35588: Incomplete validation of inner class references in ClassFileParser. (bsc#1191905)
- CVE-2021-2341: Fixed a flaw inside the FtpClient. (bsc#1188564)
- CVE-2021-2369: JAR file handling problem containing multiple MANIFEST.MF files. (bsc#1188565)
- CVE-2021-2163: Incomplete enforcement of JAR signing disabled algorithms. (bsc#1185055)
- CVE-2021-35560: Fixed a vulnerability in the component Deployment. (bsc#1191902)
- CVE-2021-35578: Fixed unexpected exception raised during TLS handshake. (bsc#1191904)
- Record
SUSE-SU-2022:0108-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
javaBitnami |
before 1.8.0, 8.0.0 up to 8.0.311 | 1.8.08.0.311 |
java-minBitnami |
before 1.8.0, 8.0.0 up to 8.0.311 | 1.8.08.0.311 |
jreBitnami |
before 1.8.0, 8.0.0 up to 8.0.311 | 1.8.08.0.311 |
java-1.8.0-ibmRed Hat:rhel_extras:7 From an advisory covering 8 CVEs |
before 1:1.8.0.7.0-1jpp.1.el7 | 1:1.8.0.7.0-1jpp.1.el7 |
java-1.8.0-ibm-demoRed Hat:rhel_extras:7 From an advisory covering 8 CVEs |
before 1:1.8.0.7.0-1jpp.1.el7 | 1:1.8.0.7.0-1jpp.1.el7 |
java-1.8.0-ibm-develRed Hat:rhel_extras:7 From an advisory covering 8 CVEs |
before 1:1.8.0.7.0-1jpp.1.el7 | 1:1.8.0.7.0-1jpp.1.el7 |
java-1.8.0-ibm-jdbcRed Hat:rhel_extras:7 From an advisory covering 8 CVEs |
before 1:1.8.0.7.0-1jpp.1.el7 | 1:1.8.0.7.0-1jpp.1.el7 |
java-1.8.0-ibm-pluginRed Hat:rhel_extras:7 From an advisory covering 8 CVEs |
before 1:1.8.0.7.0-1jpp.1.el7 | 1:1.8.0.7.0-1jpp.1.el7 |
java-1.8.0-ibm-srcRed Hat:rhel_extras:7 From an advisory covering 8 CVEs |
before 1:1.8.0.7.0-1jpp.1.el7 | 1:1.8.0.7.0-1jpp.1.el7 |
java-1.8.0-ibmRed Hat:enterprise_linux:8::supplementary From an advisory covering 8 CVEs |
before 1:1.8.0.7.0-1.el8_5 | 1:1.8.0.7.0-1.el8_5 |
Show 36 moreShow less
| Package | Affected | Fixed |
|---|---|---|
java-1.8.0-ibm-demoRed Hat:enterprise_linux:8::supplementary From an advisory covering 8 CVEs |
before 1:1.8.0.7.0-1.el8_5 | 1:1.8.0.7.0-1.el8_5 |
java-1.8.0-ibm-develRed Hat:enterprise_linux:8::supplementary From an advisory covering 8 CVEs |
before 1:1.8.0.7.0-1.el8_5 | 1:1.8.0.7.0-1.el8_5 |
java-1.8.0-ibm-headlessRed Hat:enterprise_linux:8::supplementary From an advisory covering 8 CVEs |
before 1:1.8.0.7.0-1.el8_5 | 1:1.8.0.7.0-1.el8_5 |
java-1.8.0-ibm-jdbcRed Hat:enterprise_linux:8::supplementary From an advisory covering 8 CVEs |
before 1:1.8.0.7.0-1.el8_5 | 1:1.8.0.7.0-1.el8_5 |
java-1.8.0-ibm-pluginRed Hat:enterprise_linux:8::supplementary From an advisory covering 8 CVEs |
before 1:1.8.0.7.0-1.el8_5 | 1:1.8.0.7.0-1.el8_5 |
java-1.8.0-ibm-srcRed Hat:enterprise_linux:8::supplementary From an advisory covering 8 CVEs |
before 1:1.8.0.7.0-1.el8_5 | 1:1.8.0.7.0-1.el8_5 |
java-1.8.0-ibm-webstartRed Hat:enterprise_linux:8::supplementary From an advisory covering 8 CVEs |
before 1:1.8.0.7.0-1.el8_5 | 1:1.8.0.7.0-1.el8_5 |
java-1_8_0-ibmSUSE:HPE Helion OpenStack 8 From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-30.84.1 | 1.8.0_sr7.0-30.84.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud 8 From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-30.84.1 | 1.8.0_sr7.0-30.84.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud 9 From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-30.84.1 | 1.8.0_sr7.0-30.84.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-30.84.1 | 1.8.0_sr7.0-30.84.1 |
java-1_8_0-ibmSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-30.84.1 | 1.8.0_sr7.0-30.84.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-30.84.1 | 1.8.0_sr7.0-30.84.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-30.84.1 | 1.8.0_sr7.0-30.84.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-30.84.1 | 1.8.0_sr7.0-30.84.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-30.84.1 | 1.8.0_sr7.0-30.84.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-30.84.1 | 1.8.0_sr7.0-30.84.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-30.84.1 | 1.8.0_sr7.0-30.84.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-30.84.1 | 1.8.0_sr7.0-30.84.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-30.84.1 | 1.8.0_sr7.0-30.84.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-30.84.1 | 1.8.0_sr7.0-30.84.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Module for Legacy 15 SP3 From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-3.53.1 | 1.8.0_sr7.0-3.53.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-3.53.1 | 1.8.0_sr7.0-3.53.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15 SP1-BCL From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-3.53.1 | 1.8.0_sr7.0-3.53.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-3.53.1 | 1.8.0_sr7.0-3.53.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-3.53.1 | 1.8.0_sr7.0-3.53.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-3.53.1 | 1.8.0_sr7.0-3.53.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-3.53.1 | 1.8.0_sr7.0-3.53.1 |
java-1_8_0-ibmSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-3.53.1 | 1.8.0_sr7.0-3.53.1 |
java-1_8_0-ibmSUSE:Manager Proxy 4.1 From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-3.53.1 | 1.8.0_sr7.0-3.53.1 |
java-1_8_0-ibmSUSE:Manager Retail Branch Server 4.1 From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-3.53.1 | 1.8.0_sr7.0-3.53.1 |
java-1_8_0-ibmSUSE:Manager Server 4.1 From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-3.53.1 | 1.8.0_sr7.0-3.53.1 |
java-1_8_0-ibmSUSE:Enterprise Storage 6 From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-3.53.1 | 1.8.0_sr7.0-3.53.1 |
java-1_8_0-ibmSUSE:Enterprise Storage 7 From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-3.53.1 | 1.8.0_sr7.0-3.53.1 |
seamonkeyopenSUSE:Leap 15.3 From an advisory covering 12 CVEs |
before 2.53.11.1-lp153.17.5.1 | 2.53.11.1-lp153.17.5.1 |
java-1_8_0-ibmopenSUSE:Leap 15.3 From an advisory covering 12 CVEs |
before 1.8.0_sr7.0-3.53.1 | 1.8.0_sr7.0-3.53.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-35560 is a high vulnerability (CVSS 7.5) in Oracle Java Se, published October 20, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.83%, the 92nd percentile. Fixed in java 1.8.0.
References
oracle.com/security-alerts/cpuoct2021.html
security.netapp.com/advisory/ntap-20211022-0004
security.netapp.com/advisory/ntap-20240621-0006
nvd.nist.gov/vuln/detail/CVE-2021-35560
github.com/advisories/GHSA-q6fp-hjwx-q999
access.redhat.com/errata/RHSA-2021:5030
Show 64 moreShow less
access.redhat.com/security/updates/classification
bugzilla.redhat.com/show_bug.cgi?id=2014508
bugzilla.redhat.com/show_bug.cgi?id=2014515
bugzilla.redhat.com/show_bug.cgi?id=2014518
bugzilla.redhat.com/show_bug.cgi?id=2015061
bugzilla.redhat.com/show_bug.cgi?id=2015308
bugzilla.redhat.com/show_bug.cgi?id=2015653
bugzilla.redhat.com/show_bug.cgi?id=2027731
bugzilla.redhat.com/show_bug.cgi?id=2027791
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5030.json
access.redhat.com/security/cve/CVE-2021-35556
cve.org/CVERecord?id=CVE-2021-35556
nvd.nist.gov/vuln/detail/CVE-2021-35556
access.redhat.com/security/cve/CVE-2021-35559
cve.org/CVERecord?id=CVE-2021-35559
nvd.nist.gov/vuln/detail/CVE-2021-35559
access.redhat.com/security/cve/CVE-2021-35560
cve.org/CVERecord?id=CVE-2021-35560
access.redhat.com/security/cve/CVE-2021-35564
cve.org/CVERecord?id=CVE-2021-35564
nvd.nist.gov/vuln/detail/CVE-2021-35564
access.redhat.com/security/cve/CVE-2021-35565
cve.org/CVERecord?id=CVE-2021-35565
nvd.nist.gov/vuln/detail/CVE-2021-35565
access.redhat.com/security/cve/CVE-2021-35578
cve.org/CVERecord?id=CVE-2021-35578
nvd.nist.gov/vuln/detail/CVE-2021-35578
access.redhat.com/security/cve/CVE-2021-35586
cve.org/CVERecord?id=CVE-2021-35586
nvd.nist.gov/vuln/detail/CVE-2021-35586
access.redhat.com/security/cve/CVE-2021-41035
cve.org/CVERecord?id=CVE-2021-41035
nvd.nist.gov/vuln/detail/CVE-2021-41035
access.redhat.com/errata/RHSA-2022:0345
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0345.json
suse.com/support/update/announcement/2022/suse-su-20220107-1
bugzilla.suse.com/1185055
bugzilla.suse.com/1188564
bugzilla.suse.com/1188565
bugzilla.suse.com/1191902
bugzilla.suse.com/1191904
bugzilla.suse.com/1191905
bugzilla.suse.com/1191909
bugzilla.suse.com/1191910
bugzilla.suse.com/1191911
bugzilla.suse.com/1191913
bugzilla.suse.com/1191914
bugzilla.suse.com/1192052
bugzilla.suse.com/1194198
bugzilla.suse.com/1194232
suse.com/security/cve/CVE-2021-2163
suse.com/security/cve/CVE-2021-2341
suse.com/security/cve/CVE-2021-2369
suse.com/security/cve/CVE-2021-35556
suse.com/security/cve/CVE-2021-35559
suse.com/security/cve/CVE-2021-35560
suse.com/security/cve/CVE-2021-35564
suse.com/security/cve/CVE-2021-35565
suse.com/security/cve/CVE-2021-35578
suse.com/security/cve/CVE-2021-35586
suse.com/security/cve/CVE-2021-35588
suse.com/security/cve/CVE-2021-41035
suse.com/support/update/announcement/2022/suse-su-20220108-1
lists.opensuse.org/archives/list/[email protected]/thread/5GEO4VASAXOQQYTQGGNCUBC3ZY3RFQT4